Whether to Use Anki or SuperMemo - <AUTHOR> https://masterhowtolearn.wordpress.com/2018/11/25/this-guide-will-help-you-decide-whether-to-use-anki-or-supermemo/ <comment><USER2> Note to writers: unless you're writing _only_ for an audience that is already familiar with your terminology, it's helpful to spell out acronyms and initialisms the first time you use them.

I skimmed this entire article out of curiosity. It uses the term SRS twenty times but never says what it means. I went back to the top and noticed the "not a prerequisite" link, so I looked at that article too. About six paragraphs in, the fourth mention of SRS finally gave me the key: "Spaced Repetition Software (SRS)".

This tiny bit of knowledge gave me the context to understand what the articles were talking about.

If you put definitions like this at the top of every article, you will have more informed readers who can better appreciate your insights.

<comment><USER3> It's worse than that, because even for someone who knows about SRS (via Anki), this is circuitous and hard to read.

Anyone who's a fan of incremental reading/super memo would do us a favor by writing a new introduction that's more straightforward and credible. The fact that the introductions to incremental reading have this feel of "read these hundred things to grasp the genius of incremental reading" is a huge problem.

<comment><AUTHOR> I'm OP. Thank you for the feedback!

Could you tell me more what makes it hard to read?

I've written about Incremental Reading. Hopefully this could serve as a brief introduction:

[https://masterhowtolearn.wordpress.com/2018/10/30/the- signif...](https://masterhowtolearn.wordpress.com/2018/10/30/the-significance- of-incremental-reading-in-supermemo-part-i/)

</comment></comment></comment><comment><USER4> The fundamental flaw in the author's argument for using SuperMemo is that there is a ton of value in manually creating the decks yourself. When you write out an item in pencil on paper, then copy it to Anki and create a card, you're creating a memory and physical association with the creation of that card. When you just cloze pre-made selections of reading material, you're skipping this entire process.

This is the same reason that downloading pre-made decks from Anki's website doesn't really work.

<comment><AUTHOR> I'm OP. Thank you for the feedback!

Yes, I think decks have to be personalized. But I don't agree the argument that "writing out in pencil then transferring back to a Spaced Repetition Software" is better than "pre-made selections of reading material". For Incremental Reading, you have to select the important parts; there's no pre- made selection. It's just like highlighting; the material isn't pre- highlighted. I think the most important thing is the thought process: thinking which part is important and which isn't. The medium, whether you are doing it in paper and pencil is no difference than doing it digitally.

<comment><USER4> _The Medium, whether you are doing it in paper and pencil is no difference than doing it digitally._

Science says otherwise:

[https://www.fastcompany.com/40476984/this-is-how-the-way- you...](https://www.fastcompany.com/40476984/this-is-how-the-way-you-read- impacts-your-memory-and-productivity)

<comment><AUTHOR> >"Studies have shown that taking notes by longhand will help you remember important meeting points better than tapping notes out on your laptop or smartphone."

By "doing it" I meant the thought process, the selecting process of what's important, not the medium in which you do your "whole studying".

Also that study means that taking notes by hands is better than with a computer. It doesn't mean learning with paper and pencil is better than with a computer, especially when we involve other things like a spaced repetition software.

</comment></comment></comment></comment><comment><USER5> I'm really skeptical of these sorts of memorization systems, not because I think they don't work (I think they do), but because I see it as a brain "hack" that goes against the grain.

What do I mean by this? I think of our memories as a kind of most-frequently- used (MFU) cache. We remember best when we use the information all the time. So when we use this sort of spaced repetition we're trying to artificially "warm up" the cache in our brains. We're not trusting our brains to remember the things that are most important in our lives.

If you're trying to learn a language, you should learn the way children learn their first language: by speaking. Talk to people in that language constantly. If you don't know anyone who speaks the language, what are you learning it for? If you really need to learn the language (for work?) then find somebody who speaks it and arrange to meet them for coffee on a regular basis.

If you're trying to memorize something else, such as theorems in math or standard library functions in a programming language, I'd advise against it. Learn the theorems by applying them and trying to prove stuff. Learn the library functions by doing actual programming.

In the long run, if your knowledge is situated within a context and connected to other things you know (because you learned by doing) then I believe you'll understand it much better. Memorizing by rote, out of context, will help you to recall facts which often don't have any meaning to you.

<comment><USER6> I want to learn a language but I don't think I'll be using it with anybody anytime soon. But I'd be happy to understand a newspaper or Wikipedia. What would be the recommended way to learn vocabulary if Anki is not an option?

I've been using Duolingo but it really feels like a glorified Anki

<comment><USER5> English is my first language. I didn't use Anki to learn English vocabulary. I learned by reading books and talking about them to people.

For language learning, I'm skeptical of any method that doesn't resemble real- world use.

<comment><USER6> So I should find very basic books? Because for me newspapers or even my mobile phone's interface are unintelligible.

<comment><USER5> Start with basic books but try to move up quickly to more challenging material. I read through Lord of the Rings in second grade. It was slow and frustrating at times, but the fact that the book is so engaging helped a lot. I learned so much vocabulary in such a short time this way.

Don't be afraid to keep a hard-copy dictionary of the language you're studying handy.

</comment></comment></comment></comment></comment><comment><USER7> Been using Anki for a couple of years to learn Spanish. Was "ok".

I now use Anki to learn Spanish but now I add imagery (also known as a mnemonic). Our minds don't remember text too well - but coupled with imagery they do. To boot, Anki supports audio files to even further ingrain the memory if you have the time to create the cards.

If you're super imaginative, like the Russian Mnemonist Solomon Shereshevsky, (article on front page HN today) you wouldn't need to this do, you can create anything in your mind and recall it.

This can in way (it's physically limited whereas Anki is not) be taken to pen and paper as well using the Leitner system, a few file folders and some paper. [https://en.wikipedia.org/wiki/Leitner_system](https://en.wikipedia.org/wiki/Leitner_system)

So whatever you're trying to memorize - math, names, bible verses, numbers, languages -with imagery and with spaced repetition.

I bought a book a while ago called "Fluent Forever" (not associated). The author has released an app to learn languages now using this imagery method. I personally don't like the app as it takes away the flashcard creation process reducing your "learning experience" to just a few taps. Anki, Supermemo, -insert SRS program here-, albeit harder, it's much more rewarding.

<comment><USER8> I use Anki to learn Japanese vocabulary. I have found it much more useful when I use Kanji vs. Romanization. I see Kanji differently than I do Romanization and I wonder if there isn't a picture quality to it that gets lost when I Romanize the words?

<comment><USER7> I think there's something there for sure. The ability to rewrite the Kanji correctly probably wouldn't be there (I believe it follows a strict pattern?). I was messing around with Arabic for a month and was able to memorize written words and what they meant but could not reproduce it if I wanted to.

</comment></comment></comment><comment><USER9> Spaced repetition is misunderstood. The original idea was to decrease the amount of time needed for long term memorization, over a different approach, like sequential or purely random repetition. However, many people now compare SRS over no repetition at all.

One big problem of SRS is that it gets unwieldy with larger chunks of information. SRS is good for vocabulary, bad for medical texts. The much bigger problem is that it takes an unpractical amount of calendar time. If you have three months, yes you can SRS a few hundred words. If you have a week and want full recollection at the end, you'll still repeat the list of words a couple dozen times and SRS makes no difference.

Another problem is the time it takes to prepare a database or a set of paper cards. By the time I prepare a database from a book I could probably read the thing twice or more times.

For exams that require recital of information (for example medical or law exams) mnemonic techniques like the Loci method (also called memory palace) are much more reliable and more practical.

<comment><AUTHOR> I'm OP. Thank you for the feedback! I don't see why not comparing "SRS over no repetition at all". To me, SRS or no SRS, they are all learning/studying methods.

All SRS algorithm is expanding, i.e. increasing intervals. So maybe with continue success, it'll be: 1 day, 2, 4, 16, 40, 300 (arbitrary numbers).

How do you propose to lean medical texts, if without SRS?

Mnemonic techniques only work with rote recall, whereas flashcards, if formulated well, can help induction, understanding, not just recall.

<comment><USER9> The idea with SRS is that the exponential scheduling is supposed to be more efficient than random or sequential scheduling.

I did study for medical exams with mnemonic techniques. Studies have shown that they do not inhibit understanding at all. In my experience they even help understanding. They totally dominate SRS on anything looking like a table or list. With text it's not as pronounced, but still you can memorize the key words, as few as possible, as many as necessary.

Flashcards are first of all a rewrite of the original material. If that is really necessary, the original material sucks, at least for the purposes of the exam. The physical cards are marginally easier to use than a textbook, but then again, writing them takes a lot of time and effort.

<comment><AUTHOR> SRS is mostly about the learning schedule, i.e. equal intervals and increasing intervals.

How you execute, whether with mnemonics or flashcards, is different.

With the umbrella term of "study or learning techniques", the learning schedule and execution are both included.

<comment><USER9> Usually when people talk about SRS, they mean flashcards or Software. At the very least you would need to keep track of the learning schedule and what you forget. Which I found impractical for learning large amounts of stuff.

</comment></comment></comment></comment></comment><comment><USER10> I'm a medical student who uses Anki religiously. I'll vouch for it any day. Currently, I see around 300-1,000 flashcards a day and have been doing it for almost a year straight. Without Anki, I am not sure if I'd be doing nearly as well in school. It is really a game changer for my education (at least my medical education). I wish it was more user friendly, but it is free (on Android) so I can't complain.

As for Supermemo comparison, Anki has been much easier for me to sync / utilize decks offline. I just keep a 24K card deck on my phone and sync it occasionally for a backup then I'm good to go.

<comment><USER11> I've had the idea that a lot of medical training (besides anatomy, chemistry, bio, many other things :-)) was memorizing a big decision tree to evaluate someone, which seems fundamentally different than flash cards. How do you learn that? Family history that pertinent , previous conditions etc.

<comment><USER10> Hi Latteland! I do both. Anki is about the little facts that I want to retain after I understand the bigger picture. In fact, I never use Anki to learn anything and only for retention.

Example flashcard:

\- Front: Which race has a higher prevalence of G6PD Deficiency?

\- Back: African Americans

</comment></comment></comment><comment><USER12> I figured this was written by someone working on or for supermemo, but it turns out it's not!

The author details his journey from using Anki for 5+ years to switching to supermemo: [https://masterhowtolearn.wordpress.com/2018/10/28/why-i- swit...](https://masterhowtolearn.wordpress.com/2018/10/28/why-i-switched-to- supermemo-after-using-anki-for-5-years-with-over-50000-cards-and-420000-total- reviews/)

<comment><AUTHOR> I'm OP. Thank you for the feedback. Yes I have no affiliation with SuperMemo whatsoever. My previous 5-year Anki experience gives me in a unique position when comparing both software.

</comment></comment><comment><USER13> A few months ago I built a Chrome extension that replaces the new tab page with an anki window, in an attempt to improve my browsing habits and it seems people overall are finding it useful so far,

You can find the source code and links to the web store listings in [https://github.com/corollari/ankiTab](https://github.com/corollari/ankiTab)

</comment><comment><USER14> I spend an insane numbers of hours on airplanes with my iPad. Any recommendations for which of these would be good for creating cards (with Apple pencil) and using on an iPad with no Internet connection?

</comment><comment><USER15> I'f you're a spaced repetition enthusiast you might like Polar:

[https://getpolarized.io/](https://getpolarized.io/)

<comment><USER16> What's the connection to SRS?

<comment><USER17> It implements an incremental reading system (which is built in to SM, but not Anki), including the ability to generate Anki flash cards.

</comment></comment></comment><comment><USER18> I can see lot of doubts if flash card system is working. For some of the people certainly it is:

[http://augmentingcognition.com/ltm.html](http://augmentingcognition.com/ltm.html)

The above is the first link from the HN discussion which I really recommend to everyone:

[https://news.ycombinator.com/item?id=17846356](https://news.ycombinator.com/item?id=17846356)

</comment><comment><USER19> The main hump I need to get over before committing to either tool is deciding what's important enough to remember. If I were learning a language, using spaced repetition would be obvious. In most other areas, it's not so clear whether it's important to remember the contents of any given book or article.

I suppose I could apply it to remembering songs I've learned how to play, but I'm just doing it for fun.

<comment><AUTHOR> It takes time to consider whether something is worth committing to memory. I constantly rewrite cards and delete them.

</comment></comment><comment><USER20> Is SuperMemo free (unless you book pre-set vocab sets)?

And is there an export function to avoid vendor lock-in? (Don't want to tempt my luck and waste my time scripting or writing a GDPR request)

and are we talking about [https://super-memo.com/](https://super-memo.com/) or [https://www.supermemo.com/](https://www.supermemo.com/) ?

<comment><USER21> There's an actual program, and a saas version. The saas version isn't worth paying for (imo) over using AnkiWeb unless you wanted preformatted decks, and the most up to date version of the algorithm.

I've experimented with using the website (mostly because I'm a fan of the software). It's mostly okay. I've been using Supermemo (the actual app) for a few years now on a daily basis. The app itself has a trial if you can find a download link somewhere, and I believe the site might be free if you import your own decks.

As far as lock in, I believe you are also locked in unfortunately. This would be another reason to go with Anki or another solution if you just want flashcards.

</comment></comment><comment><USER22> The choice for me was quite simple, paying once for the great Anki app, or monthly subscriptions for SuperMemo?

Since I abhor the subscription trend it made picking easy.

<comment><USER23> The actual desktop SuperMemo app (supermemo 17 I believe) is not subscription based and is way way more powerful (but also convoluted and somewhat outdated UX wise). The web supermemo is dumb down and mainly for language learning.

<comment><USER24> Can't use the desktop one easily on Linux however, and can't study on the train with it unless I'm mistaken.

</comment></comment></comment><comment><USER25> I am an Anki user and would love to try SM but the UI is so clunky it is so hard to use. I wish someone put together a comprehensive guide/book on using SM. I went through a few on YouTube from the creator of SM and they were okay but it was still hard to use.

</comment><comment><USER24> Supermemo web doesn't let you export your cards. Maybe there's a way to do it, but I'm using anki so I never lose my cards in case the service goes away or has data loss

</comment><comment><USER26> What makes anki not suitable for "incremental reading" ( interleaving between reading and remembering) ?

<comment><USER27> There is most certainly a way to do 'incremental reading' in Anki, though it must be done manually. You can do virtually any type of reviewing in Anki with its high degree of customization.

</comment></comment><comment><USER28> This article comes at the perfect time for me, while I'm about to choose a tool to read Japanese sentences!

</comment><comment><USER29> Is there a SuperMemo-like tool for Linux?

</comment><comment><USER30> I'm a bit surprised these systems still pay off for people. How many contexts require learning large bodies of unrelated facts, these days? Everything's just a google away. Even in the past, the only context where I would have used a system like this is language acquisition, and it's pretty clear that machine translation is going to surpass me very soon, if it hasn't already.

For me, most interesting work involves conceptually coherent bodies of knowledge. Learn the conceptual framework, and you'll remember the details by partial reconstruction as you need them. At least, that's how it usually works for me.

<comment><USER31> All of them except programming, I'd say. That sounds like a 2000's-programmer- centric view of the world. Modern software is unique among all the fields I've worked in, in that it combines:

\- people routinely working on systems far too complex for them to ever understand fully, and which often change completely on the timescale of weeks or months

\- all the relevant data on the web in a format (like error messages or function names) that's easy for google to index, and easy for users to type

\- people sitting in front of internet-connected computers anyway, and sufficient time slop that the team doesn't need an instantaneous answer

When I was knee-deep in water at an archaeological dig 15 years ago and my professor called out "What species of tree is that by your knee?", or when I was working on the catwalk last week and my lead called over "Check that the instrument in front of you is safe", googling it would have been completely infeasible, for several reasons. They'd just replace me with someone who knows what they're doing.

> Learn the conceptual framework, and you'll remember the details by partial > reconstruction as you need them.

When I took organic chemistry, they taught the special cases of each reaction type first, and then generalized them at the end of the year. When I took engineering physics, they made us start with the generalized form first, and then we had to derive the specifics as needed. At the time, I was frustrated by the chemistry approach (why didn't you tell us there was a simpler form?!), but 20 years later, I remember a lot more chemistry than physics (even though my grades in physics were much better). I might be able to fumble through an SN2 reaction if I needed to, but I'm sure I couldn't do anything at all useful with Maxwell's Equations.</comment></comment>


Web attack blogger blames Russia  - <AUTHOR> http://news.bbc.co.uk/2/hi/technology/8190786.stm

<comment><USER2> Is it me, or does this look like an obvious ploy to get attention? It seems pretty well-timed too, to conincide with the 1 year anniversary of the attacks. I'm suggesting that he hired the botnet to attack his own site.</comment>


SPMF: A Java Open-Source Data Mining Library - <AUTHOR> http://www.philippe-fournier-viger.com/spmf/index.php?link=algorithms.php <comment><USER2> Thanks for posting</comment>


The Top Ten Lies of the Past Decades - <AUTHOR> http://benatlas.com/2010/08/the-ten-top-lies-of-the-past-decades/ Got more lies? <comment><USER2> This is one of those blog posts that appears to take longer to read than it did to write.

If the author were to take one of his 10 ideas, think about it for a few minutes, and then write a paragraph of insight, there might be something there. At the moment, we're left with a list of vague, poorly phrased bullet points, which is no substitute for an argument.

</comment><comment><USER3> So wrong, I don't know where to start ... "The Internet will change our lives for the better. In reality the Internet facilitated the outsourcing, accelerated the impoverishment of the middle class, destroyed the creative class – musicians journalist, writers." ... and empowered the masses worldwide to take over roles that once were exclusively reserved for middle-class western fatcats. I don't regret that.</comment>


NetCDF or HDF5 - <AUTHOR> I have been using HDF5 for a while now, and have always been happy. However, I've seen some people who are loyal NetCDF users.<p>I am storing 3D, 4D, and 5D arrays, and since I am starting a new, multi-year project, I would like to know your take on NetCDF and why would someone consider using it over HDF5 (for instance, long-term support, etc.) <comment><USER2> Are you aware that netCDF-4 has partial supports for HDF5 format?

[https://www.unidata.ucar.edu/software/netcdf/docs/interopera...](https://www.unidata.ucar.edu/software/netcdf/docs/interoperability_hdf5.html)

<comment><AUTHOR> Yes, I am. That is what made me wonder, why would you go for one or the other? What would it be the feature that makes you tip the balance towards one or the other?</comment></comment>


How would you market Windows 7? - <AUTHOR> http://arstechnica.com/journals/microsoft.ars/2009/01/23/how-would-you-market-windows-7 <comment><USER2> It seems like whoever is working on marketing Windows 7 right now is doing a pretty good job. I'm seeing glowing reviews of it all over the place.

</comment><comment><USER3> Down and dirty, guerrilla style. I'd bribe bloggers and exploit social networks.

</comment><comment><USER4> I guess the Vista guy didn't get the job.</comment>


Ask HN: Are side-projects still a good way to generate passive income? - <AUTHOR> I recently had the opportunity to read the famous personal finance book - "Rich Dad, Poor Dad"
I'm thoroughly inspired by the book. The bottomline being, use income to maximise assets and eventually use assets to maximise income.
In my case I'm starting at ground zero. Reasonably good income. Minimal liabilities. Absolutely no assets yet (except my software-making skills that I've acquired over these years)
I've decided to write softwares (likely a SaaS product) that would generate passive income, which would serve as my first asset and then start from there to maximise them.
I know this isn't as easy as it sounds. Anybody who've gone down the same road that I'm about to take? Stuff that I should watch out for? Is this too silly? <comment><USER3> My experience is that yes, it is possible to generate a passive income with side projects (by passive I mean <5h work per week).

As someone who has built and sold a SaaS company however, I'd strongly recommend against starting off with one. They are almost never passive!

If your main goal is to make some money on the side, I'd recommend you first try:

\- An info product (a course, ebook, video course etc)

\- Something in the ecommerce space (check out lasertweets.co by Josh Pigford for inspiration)

It's a lot easier to make $1-10k/month with just a few hours work per week (and time invested upfront of course) doing something like this than it is with a SaaS.

SaaS is just too time intensive with support, sales, product dev etc.

Source: Have built a SaaS, an ecommerce project and am now working on my first info product.

<comment><USER3> Am being seriously downvoted. Anyone care to explain why?

I know the idea of software (and SaaS in particular) being a tricky passive side project is unpopular amongst the HN crowd, but unfortunately it's true.

<comment><USER4> > It's a lot easier to make $1-10k/month with just a few hours work per week.

$10k/month with just a few hours per week is BS. $120k / year would be a lot more than many peoples salary.

<comment><USER5> Other than a few western countries, $120K USD per year is a lot more than many people's _multi year_ salary

</comment></comment></comment></comment><comment><USER6> I'm going to go somewhat opposite to altariumblue.

Don't try to come up with a good idea. Come up with a few or even a lot of pretty decent ideas that can easily be monetized. After you figure out these ideas, figure out the shortest path to solve the problem they are after.

Build the shortest path in a decent way but don't spend years on it. Launch it. Did people like it? Did at least one person give you money? If not, go onto the next idea. If you love the idea, no need to slash and burn but if you're not sure the next step, play with another idea for a while.

"That's just luck!"

Uhhh... yeah. You're making your own "luck". Don't scam people obviously but don't feel like you need "That One Great Idea" either. Try out lots of things to help people in exchange for money until you find "That One Pretty Good Idea"

source: I wasted two years trying to build "That One Great Idea"

<comment><USER7> Would you recommend launching a new saas product in demo mode first, to gauge interest? For example, allow users to create a free account that works for two weeks to a month? Then hook in a way to get people's money after you have received enough feedback in the form of "Can I please throw money at you to purchase this product"?

I think one major hang up for first-timers is crossing that threshold of taking money, because now you have liability. Which includes dealing with support issues (will customers be satisfied with 24 - 48 hour turnaround time, will they be OK with web/email support only because you have a day job?), and also you need to deal with fraud and other legal issues.

<comment><USER6> >Would you recommend launching a new saas product in demo mode first, to gauge interest?

If you think that would work. I have tried it before, people did use it but they never bought. You bring up that issue later in your post though. :) People are cheap. I never really dug into this idea further because I was cautioned by others that "Free SaaS" and "Paid SaaS" are different people.

You even bring up the issue of support around "Free SaaS" people. That crowd I think generally thinks "Free SaaS" == "VC". In my experience, as long as you get back to people within 12 - 24 hours, they don't mind. I go on walks during my day job and respond to support emails. ;)

>I think one major hang up for first-timers is crossing that threshold of taking money, because now you have liability.

Definitely! That's still kind of a hang-up for me. I feel kind of bad asking for money for something I built. It is slowly going away though the more that I do it though. I think this is a common thing though.

>also you need to deal with fraud and other legal issues.

I guess that depends on what you're building. Stripe, for the most part, handles the fraud and legal stuff. While we are talking about Stripe, I would recommend against Stripe Atlas. It is too much if you aren't going VC. An LLC (provided you're from the US), if even that, is enough.

\---

Honestly, you should just try out all these hypothesis and apply what you learn. That's what I've been doing. Try something new, apply, try something new, repeat. It's the best you can do in my opinion. Reading books + blogs is great, I totally still do it, but beware analysis paralysis. ;)

</comment></comment></comment><comment><USER8> \- to generate income you need to either provide something valuable, scam people or get extremely lucky

\- if you want to provide something valuable you need a good idea, some skills and hundreds or even thousands of hours of work on your idea

\- all that work on creating and maintaining your project makes the potential income not passive at all

My impression is that the people who succeed at this usually start with a good idea, work on it for a while and somewhere down the line potentially turn it into an income stream. But the interesting idea comes first. On the other hand, the people who begin with the goal of making money and just the wish to "have passive income" or "be an entrepreneur" usually don't get anywhere. Unless they scam people or happen to get lucky, of course.

Also, everything from Robert Kiyosaki including "Rich Dad, Poor Dad" is somewhere on the scale between questionable advice and scam.

<comment><USER9> It's a matter of scale. How many teenagers do you know who make $5 here, or $10 there, just mowing lawns, cleaning windows, or doing babysitting?

They're making money without luck, without scamming, and without being terribly valuable.

The problem is those things don't scale. I can imagine a couple of happy teenagers raking in $400-$500 a week, if they really push themselves, but it will be very seasonal work.

Hrm. uber for lawns? facebook for windows? (There are a lot of agencies that work as middlemen for childcare, where often vetting and background checks are involved. I'm not familiar with such a thing for pet-walking, window-cleaning, or lawn-mowing. Perhaps they exist, or perhaps there's your cheap and easy idea! Physical labour is cheap, anyway :)

<comment><USER10> Pet-walking: rover.com

<comment><USER11> Rover.com seems to be pretty shady [https://www.gofundme.com/rovercom-sitter- killed-my-dog](https://www.gofundme.com/rovercom-sitter-killed-my-dog)

[https://www.gofundme.com/my-rover-sitter-killed-my- dog](https://www.gofundme.com/my-rover-sitter-killed-my-dog)

[http://www.roversdirtysecret.com/tag/killed/](http://www.roversdirtysecret.com/tag/killed/)

</comment></comment></comment></comment><comment><USER12> Have side projects ever been a good way to generate passive income? For some people, sure. For most people, I'd argue it's a terrible financial decision. Most side projects fail and never generate any revenue. To stray from the software focus, how many people actually make money trying to sell Avon products (or Amway, etc.)? How many people lose money becoming a realtor to attempt a side job? Set up a booth at a flea market to hawk wares? Advertise their gutter cleaning service and never get customers?

The vast majority of non-mainstream money-making ventures fail. That doesn't mean they're a waste of time, especially if you enjoy the activity anyway. And there's something to be said for taking a chance. I applaud entrepreneurs on all levels. The idea that a side project in any field makes good financial sense is unfounded, though.

</comment><comment><USER13> It's great if you're inspired, but be aware Kiyosaki is primarily a salesman: [https://johntreed.com/blogs/john-t-reed-s-real-estate- invest...](https://johntreed.com/blogs/john-t-reed-s-real-estate-investment- blog/61651011-john-t-reeds-analysis-of-robert-t-kiyosakis-book-rich-dad-poor- dad-part-1)

<comment><USER14> Thank you for this. I wasn't aware Kiyosaky was such a con. Friends of mine religiously adhere to his teachings (hint: no one got rich, yet).

</comment></comment><comment><USER15> In my experience, money as a side-project motivator or measure of future side- project success is folly. Make your side projects for fun, find other motivating factors to finish, or don't finish, it's all good. If you make something and gain adoption, then you can consider monetization. But otherwise, I've found building an imaginary future income on your not-yet- built, not-primary-work software does not result in happiness or success.

Granted, this is just my experience and only applies to side projects.

</comment><comment><USER16> > Anybody who've gone down the same road that I'm about to take? Stuff that I > should watch out for?

The major trap is to make sure people are willing to pay for what you're building. Don't spend ages building it in secret attempting to make it perfect and then find out nobody is willing to part with cash for it.

I'm making income from [https://www.checkbot.io/](https://www.checkbot.io/), a Chrome extension that crawls your website looking for SEO, speed and security issues you should fix. I started building it to help automate what I was doing for clients so I knew the results were valuable and web developers I showed it to said they'd be willing to pay for it as well.

<comment><USER17> I don't often see people making money from extensions. Could you share what you are making? I understand if not.

</comment></comment><comment><USER18> Passive income is not starting a SAAS. That's "starting a SAAS." If you are able to build it and market it in a way that later on you dont have to do as much work THEN it can be passive income. But the idea of "I'll build a saas and make some easy money" is a terrible idea in almost every case.

</comment><comment><USER19> I think the people making most passive income are those selling the passive income books and advertising :-)

My friend in the IT business says I am the only person he knows making close to passive income. I have a side project which has been generating income for the last 10 years. The sideline involved a lot of work to setup and after years takes little of my time.

So I would say go for it if you want to swap some of your time for money. I am proud of my sideline but most good things come at a cost.

</comment><comment><USER20> Gambling is a great way to generate passive income so long as you always win.

Personally, I've found side-projects to be valuable even if they're not profitable. You gain experience, knowledge and you might even enjoy yourself too.

</comment><comment><USER21> I know about 100 people who made a moderate to serious attempt at passive income, and the hardest part is finding something people will pay for. I can categorize them all into a few buckets:

1\. Got industry experience through freelancing, and used that to find something valuable

2\. Worked on their "passive income" project fulltime for > 6 months

3\. Both, or

4\. Made less than minimum wage

Now, anecdotes aren't data, and most of these people aren't software engineers. But I would encourage you to try taking your product ideas, freelancing in that industry with small contracts, and using that to refine your sense of what the market wants.

</comment><comment><USER22> Maybe a bit off-topic. Say I have an idea for a web app. More like a service. I also have a person who's willing to go out to the targeted group and present the product/get feedback.

Personally I'm a Java backend developer, and building MVP for the backend part is a piece of cake.

But I lack UX and mobile development skills, which is the crucial part of the idea.

Is there a place/site to present the idea (no need for any NDI - not that kind of person) and get someone on board for development in needed areas?

<comment><USER23> Drop me a line.. I'm full stack... read: Not a designer, and not an x10 dev, but I can use vue+vuetify, or Quasar, or Ionic Framework to build out the frontend. Been trying to find a coder to team up w/ for a VERY long time... Wouldn't mind helping out on back either, I haven't had a chance to do much w/ Java, would love to put that on my resume. patrick @ Zvive.com

</comment></comment><comment><USER24> I was thinking about making apps catered towards places where android devices are just getting popular. Like imagine a country like Bangladesh. A homogenous population of 180m where most of the people probably have similar needs and speak the similar language. The playstore barely has apps to cater to the people. I think the absence of apps can probably be attributed to developers unable to hire UX designers and maybe lack of good hardware. A lot of the current Bangla apps that are out there are very poor in terms of design. They look like they were made by a solo dev. And the devs are probably missing the point that a lot of "pointless" apps are able to make money in the states. They probably don't see the opportunity. The hot startups in Bangladesh are trying to copy Uber and Grubhub.

That's my current goal right now. I've been trying to learn android dev for a while but it's hard to manage with a fulltime job...maybe I'm making excuses.

</comment><comment><USER25> If I had time for a side project I would either do:

* an info product (a book on a popular new technology, or an evergreen topic, preferably related to software development). The best example here was the stripe rails book. I bought it for $40 because it saved me hours of dev time. Used it once. Never opened it again. Was worth every penny. [https://www.masteringmodernpayments.com/](https://www.masteringmodernpayments.com/)

* Or, if I was looking for a longer play, find a local niche business type where people spend money and search online. Prefer if data is already collected by someone else (data.gov or the state agencies are good places to check, for example child care facilities). Use a WordPress directory plugin to gather demand side up and then monetize by ads plus premium listings.

No coding for either of these.

<comment><USER5> About your second idea : do directory sites still make money? Doesn't Google frown on these?

<comment><USER25> I don't know about the SEO implications, but I think a well made directory site that provides value to consumers would work. I run one for CSAs that I haven't monetized thoroughly and several of my competitors have done a much better job of. And I don't see Google penalizing them. #anecdata

</comment></comment></comment><comment><USER26> The problem with passive income is someone else will be prepared to do the same (i.e. not much!) for very little money.

The market is likely to _eventually_ price stuff that requires no effort to make, very cheaply.

You may be able to get quite a lot of money out of it before that happens, depending on how brilliant your idea is.

</comment><comment><USER23> A SaaS can fail... if you're the solo dev on it -- nothing you build is ever a failure. Most other business ventures - like someone mentioned 'info products' \-- none of those has inherent value unless it's a success and you make money.

The value in ALL side projects is that as long as it's 'live', it's something you can use on your portfolio, and worst case scenario -- open source that baby -- and now you're an OSS maintainer.

</comment><comment><USER27> > that would generate passive income.

I am also a big fan of "Rich Dad, Poor Dad". Coupled with "The Richest Man in Babylon", I think these two small books told me pretty much all I wanted to know about how to get rich.

Passive income is great. However recently I learned a new term - <USER2> income. Delayed income, or lack thereof, is what all my side projects have been about. I start with an idea that I'm gonna sell this product to 1000 people at $30/mo, it'll generate 30k monthly for me, and I dont' have to work for anyone. Then I either "gonna sell it to 30 000 ppl for a $1" or "gonna sell it to 300ppl for a $100" or "gonna sell it to 50 per $100" cause 5k monthly isn't at all bad... I'm only gonna work like 10/20 hours a week, but wherever I want, and not reporting to anyone... Needless to say, it's all very stupid, but my point isn't about that.

My point is that I never took into consideration the time I need to spend upfront. Assuming you need to work, say, 3 months. You're a software engineer, who makes "Reasonably good income". That's what? 3 months * 4 weeks * 40 hours * say 40/hour ~ $20k.

So you work for 3 months in hopes to later make more than 20 grand later. So when later you finally, if you're very lucky, start making money, it's not really all that passive, it's delayed. You just weren't paid. And most of the time, unfortunately \- nobody is interested in your project \- or you didn't finish it \- or you just don't make back the money you invested. \- or something else.

Passive income is when you buy stock and don't do literally anything. Or something similar.

Maximizing your income is a different thing, getting paid 40/hour or 100/hour is a different conversation from passive income and feels like something you might want to think about.

So yeah,

> I know this isn't as easy as it sounds. Anybody who've gone down the same > road that I'm about to take? Stuff that I should watch out for? Is this too > silly?

Don't work for free, especially for yourself. Every hour you spend on your project must be accounted for. You could be doing contract work and getting paid during this time, so ask yourself: is it worth it?

Starting a new project is very easy, completing it is super hard. So if you want to do this, maybe try to do a simpler project, something you can be done with sooner, which would mean risking less. Ideally of course, do something you enjoy, in which case it won't be such a drag doing it as work, because if it's successful, it's nothing more than more work.

</comment><comment><USER28> As a few other people have said, running a SAAS will probably be more time- intensive than you anticipate. An informational product like a book or video series is much less time-consuming and requires less upkeep. Your business model (selling a product) is also a lot simpler and easier to experiment with than a monthly subscription plan.

</comment><comment><USER29> How much of books like Rich dad, 4 hour workweek etc is practical? Kiyosaki is more of a salesman than an investment wizard. Tim Ferriss is successful, but works his ass off, far from 4 hours a week. Not saying these books are useless, but wondering if we should take them at face value.

<comment><USER30> Tim Ferris's literally used to do sales too. I read his book as more of a philosophy book personally

</comment></comment><comment><USER31> To me, passive income is to make content based sites, streamline traffic sources, paste ads and check back twice a month to see how it goes.

So, if I have 10 sites each making $100/month "passively", that's some nice passive income on the side.

</comment><comment><USER32> The hope the dream, chasing the SaaS.

Lots of developers succeed with side projects, products/SaaS. It isn't easy, but it's possible, worth chasing.

Checkout @DHH's Startup School Talk for some inspiration. [https://www.youtube.com/watch?v=0CDXJ6bMkMY](https://www.youtube.com/watch?v=0CDXJ6bMkMY)

Check out the StartUpsForTheRestOfUs.com podcast if you haven't already.

Rob is a great story to follow, from drop shipping, to job sites, invoicing app to founding and exiting drip.com. He calls it the stair step approach building up to a SaaS.

Start in the archives Episode 1. All the advice is still relevant.

Good luck.</comment>


ask hn whats best place to write - <AUTHOR> <comment><USER2> Offline.

Seriously. It slows you done, which gives you time to focus on how you're feeling while you're writing. Plus, it's a nice break from screens...</comment>


Failure of Neal Stephenson Kickstarter - <AUTHOR> http://www.wired.com/gamelife/2013/09/clang-kickstarter/

<comment><USER2> The Clang kickstarter announcement underscores the importance of good public- facing communications, which is sorely lacking here. I'm not too astonished that the devs _feel_ the way the announcement reads, but this shows how there's value in having "inside words", and a different public-facing voice. Their public-facing communications should be intended to improve the company's prospects, not hurt them.

</comment><comment><USER3> Dang- their kickstarter video was so incredible that all I wanted was for this project to work. The letter they have does nothing to acknowledge the let down of the people, and didn't take responsibility... both parts of legitimate apologies.

</comment><comment><USER4> I can see it now: "I enjoyed reading this Neal Stephenson Kickstarter, but it didn't have a conventional denouement, and had lots of loose ends."

</comment><comment><USER5> In a diamond age of VC funding, his effort to crowdfund snowcrashed.</comment>


Mom creates birthday Facebook page after son says he has no friends - <AUTHOR> http://abclocal.go.com/wls/story?section=news/national_world&id=9427862

<comment><AUTHOR> Go tell this kid happy birthday.

Adolescence is already hard enough. Going through it with Aspergers and feeling like you have zero friends has got to be a lot worse.

I think that this is something that folks in on this message board can relate to. Imagine being able to help him out, even just a little bit.

</comment><comment><USER2> I would totally visit his party if he was near me (well, at least on same continent)

Kinda reminds me [http://gigaom.com/2010/09/02/4chan-decides-to-do- something-n...](http://gigaom.com/2010/09/02/4chan-decides-to-do-something- nice-for-a-change/)</comment>


My account is sending spam emails - <AUTHOR> https://productforums.google.com/forum/#!topic/gmail/jtXGmic9dkc;context-place=forum/gmail <comment><USER2> Exact same thing for me.

Noticed I was getting emails being sent from myself. More worringly was the emails appeared in my SENT folder. For 5mins I was freaking out thinking I was hacked, because I didnt think spoofing emails would show up in MY "sent" folder.

But I run 2FA, long complex unique password etc. I treat OpSec really highly. I checked all Google security settings, no unauthorised access, no apps using my account etc. Still did a password reset "just in case".

However one interesting part is after about 4 hours the emails automatically became marked as "spam" \- and they disappeared from my "sent" folder simulatenously.

So it would seem the likely issue is someone worked out a way around the "Spam" setting for Gmail - and a by-product of not flagging spoofed emails as spam is Gmail marks them as "Sent" by you in the labels.

Seems this was flagged as a security risk over a year ago - and Google declined to fix? [https://www.zdnet.com/article/spammers-delight-gmail- weirdly...](https://www.zdnet.com/article/spammers-delight-gmail-weirdly- doesnt-see-spoofed-gmail-com-addresses-as-junk/)

<comment><USER2> Here is a raw header for people smarter than me (I've changed my email to "firstname.lastname@example.com":

        Delivered-To: email@example.com
        Received: by 2002:a02:9d5d:0:0:0:0:0 with SMTP id m29-v6csp2463224jal;
                Sat, 21 Apr 2018 22:54:19 -0700 (PDT)
        X-Google-Smtp-Source: AB8JxZqeE/hqXWlPnOWNRXo4XX3nwZh/+NGaQwquAFr/o2KzBe7Ub8QYDmcPIiZPkY2UoHRI3eOH
        X-Received: by 2002:a19:c457:: with SMTP id u84-v6mr6519818lff.109.1524376459326;
                Sat, 21 Apr 2018 22:54:19 -0700 (PDT)
        ARC-Seal: i=1; a=rsa-sha256; t=1524376459; cv=none;
                d=google.com; s=arc-20160816;
                b=yNz7pv3/Uh4jUBqrFSpnrhROAQ6bdU0eiolhXCpHXodEBCygkRTsVIZiSPxU1e66PU
                 +y1dJAT4q911YZE9Qb8jUKZ0yYuamvXY4NHGbN7hQzYR36ocZP4cuqrYZoLzrWzqWMjQ
                 0PcYbDK5dgKO4yhJj4ymhDMW05YZATsYqmaianc6O4KmG0i1dPCvHu0Rjl4lWFfX1UEX
                 jQK3/rA4Kqji/dHCqj6mHqiit2yzdj7XJTdoIiTdcBhWGoGOov1oCvpdzwQYRPCGe5qN
                 A3l5e0qgqYY/aWmEWJ5Ia8vwvbWWQvbe+nH2AxQf0KArHXQ/ktQb8oBackZTljwQivgI
                 ziIw==
        ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
                h=date:message-id:subject:to:from:arc-authentication-results;
                bh=e9D0rlZHq51n3B4mRj4EfKnNKsv8i1UrXVRpskBltKg=;
                b=QVTaX2wLGCYZzWS7YGqc7Ck1ZiLTbKEVNYjhOJqiJkqKqeR6r7dEhGMUFNpOGAQOYB
                 Y5X/r0uktROpPceC8EzBnhLXtuVUJP2Q3Uje4QvTYLPrdMx8V1UvqJ4Wx6sxsHZR1tJB
                 69rtTABGlOC2ZW3dE7uqiVtsIukJmb/HQDOItX5g+ifsyBy4A9KZbKWpU9agqaD1NOpG
                 Rm7PnBzMAPbD0s02QBCeErZp+Irax0Gk7WzkGsJfO+GWjPMZN6DpWLvgS/vBRN0/Tz+B
                 xLb3VO+EPN6bG2ZvGqRJZ4LlbQIVFpBQGRFAAqMQLDEZGKTFJxrA4uO3NMMRqbQno5IM
                 cc6Q==
        ARC-Authentication-Results: i=1; mx.google.com;
               spf=pass (google.com: domain of firstname.lastname@example.com designates 184.108.40.206 as permitted sender) firstname.lastname@example.com;
               dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com
        Return-Path: <email@example.com>
        Received: from rine.play-wto.com ([126.96.36.199])
                by mx.google.com with ESMTP id b69-v6si4041238lfe.13.2018.04.21.22.54.19
                for <firstname.lastname@example.com>;
                Sat, 21 Apr 2018 22:54:19 -0700 (PDT)
        Received-SPF: pass (google.com: domain of email@example.com designates 126.96.36.199 as permitted sender) client-ip=18.104.22.168;
        Authentication-Results: mx.google.com;
               spf=pass (google.com: domain of firstname.lastname@example.com designates 188.8.131.52 as permitted sender) firstname.lastname@example.com;
               dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com
        Received: from gown.ShoppingBrew.com (ec2-13-58-85-245.us-east-2.compute.amazonaws.com. )
                by mx.google.com with ESMTP id n59-v6si5794010qtd.116.2018.04.20.00.37.14
                for <firstname.lastname@example.com>;
                Fri, 20 Apr 2018 00:37:14 -0700 (PDT)
        Received-SPF: softfail (google.com: domain of transitioning email@example.com does not designate 126.96.36.199 as permitted sender) client-ip=126.96.36.199;
        from: Bitcoin Loophole <email@example.com>
        To: <email@example.com>,<firstname.lastname@example.com>,<firstname.lastname@example.com>,<email@example.com>,<email@example.com>,<email@example.com>,<email@example.com>,<email@example.com>,<firstname.lastname@example.com>
        Subject: Are you still alone?
        Message-ID: <firstname.lastname@example.com=Mx.google.com>
        Content-Type: multipart/report; boundary="f4f5e80f07d80f991b056a2936a0"; report-type=delivery-status
        X-EMMAIL: <@googlemail.fr firstname.lastname@example.com>
        Date: Sun, 22 Apr 2018 01:54:19 -0400

<comment><USER3> Yeah, this looks pretty straightforward. As I read it, it looks like telus.com has set up SPF records allowing people to send mail as @gmail.com via Telus' servers. That's fine. These messages are being sent with a "firstname.lastname@example.com" return address (the "envelope from"), but they are coming from gown.shoppingbrew.com and rine.play-wto.com (I don't get why there are separate received headers here from different sources -- usually multiple received headers form a chain of custody for the email, and this looks like two different sources somehow both sent the same message ... maybe one of those is forged?).

The only part of this that looks like a Google-specific bug to me is that I'm not sure Gmail should be dropping messages into your Sent folder that did not originate from your authenticated account. If you send a message using some other mail client that logs in to your Gmail account, or an app, or the web app, sure, but if a message just pops into your account with your address as the "from:" header, it shouldn't show up in your Sent label.

The rest of this is just email being as broken as it usually is.

SPF only checks the envelope-from. It doesn't check the other "from:" header. Anybody can easily clone anybody else's SPF records, so any service that allows you to route mail through them _and_ has already cloned Google's SPF records (so that users can send mail through Gmail's servers using their @telus.com address) is vulnerable to this.

If SPF were changed to also check the other from: header, then it would break every single domain that uses Google's mail hosting services but hasn't updated their SPF records. So that's never gonna happen.

This is maybe the biggest reason I wish people would stop using Gmail for any kind of important mail services. The moment you do that, mail from your domain can be spoofed by any other outfit that also uses Gmail, and it will pass SPF, which means it'll cruise right through most spam filters.

DKIM can resolve some of this, but it comes along with a suitcase full of its own nightmares.

<comment><USER4> Neither DKIM nor SPF provide domain owners with a verifiable disposition policy and monitoring. You should deploy SPF, DKIM and DMARC together. At that point either SPF or DKIM may pass but if the passing SPF/DKIM domain(s) don't match the DMARC domain the message isn't authenticated. Unlike SPF, DMARC will load its policy using the From: header, and thus ensure alignment between envelope-From and From: header (for SPF), or DKIM domain and From: header.

<comment><USER5> DMARC could solve this problem, but it would break a lot of things reliant on forwards. When Yahoo set their DMARC policy to reject, there was quite a stir about it: [https://www.ietf.org/mail- archive/web/ietf/current/msg87153....](https://www.ietf.org/mail- archive/web/ietf/current/msg87153.html)

In this particular case, it seems the major issue is that spammers got access to 18.104.22.168, which is included in telus.com's SPF record. In the end, this will hurt deliverability for legitimate emails sent with telus.com in the return path, and I suspect telus.com's customer service will have some explaining to do for their customers.

<comment><USER6> ARC is the new standard designed to fix the DMARC edge case with forwarding. It's relatively new, though, so adoption isn't nearly as widespread as SPF, DKIM, or DMARC.

</comment></comment></comment></comment></comment></comment><comment><USER7> Don't freak out about them being in your Sent folder. Remember that Gmail doesn't have "traditional" mail folders -- just a huge pile of all your e-mail messages with "labels" attached to them. Apparently Google decides that if the From: address is yours, then you "sent" the message.

Note that in SMTP there are _two_ "from addresses": the envelope sender (which you don't see) and the "From:" address/header (which you do see) that everyone is familiar with. In most (but not all) legitimate e-mail, they will be the same.

In these cases, your e-mail address is being used in the "From:" and "To:" headers but a different address is being used in the envelope sender (which is the one that the MTA uses).

Google does seem to be checking SPF correctly (i.e., according to RFC, which says to use the envelope sender) -- since (it seems that) the result of check_host should be "softfail" and the RFC says that one "SHOULD NOT" reject a message based on that... but Google apparently logged "pass". Odd.

\---

 _ETA_ : See a comment from _ryan-c_ below about the funky "exists:" mechanism in Telus' SPF record; it explains why check_host() passed.

<comment><USER8> > In most (but not all) legitimate e-mail, they will be the same.

Just to be clear, most automated emails from major providers have them different. This is because, while the From header is shown to the user, the envelope sender is sent bounces.

So companies like Google, SendGrid (used by GitHub), and MailChimp set up special "bounce handler" addresses as the envelope sender to detect if there's a problem sending you email.

[https://en.m.wikipedia.org/wiki/Variable_envelope_return_pat...](https://en.m.wikipedia.org/wiki/Variable_envelope_return_path)

</comment></comment><comment> mike-cardwell Some of you posting raw message sources might find a website I built useful:

[https://www.parsemail.org](https://www.parsemail.org)

From my about page:

"Paste the raw source of an email into the form on the front page. The email will then be parsed, decoded, separated into its various MIME parts, and displayed in an easy to view fashion. Image attachments will be displayed as images. HTML parts will be rendered in webkit (with javascript and plugins disabled) and then also displayed as an image. IP addresses in headers and message bodies will be identified and highlighted along with a flag representing their origin country. Hostnames and email addresses will also be identified and highlighted."

<comment><USER9> Wow, that's really useful!

Whenever I get a weird/suspicious email the first thing I do is look at the source but the amount of info in there (and different encodings) can make it hard to grasp what's going on.

I'll definitely use this in the future!

</comment></comment><comment><USER10> Hi all,

Seth Vargo here from Google. Thank you all for taking the time to report the issue, and thank you for your patience as we fix it. Our engineering teams are aware of this issue and they are working to resolve it as quickly as possible. You should no longer see new spam messages appear in your sent box, and existing spam messages will be automatically removed over the next few days.

<comment><USER11> Can you comment on what the issue actually is? Is the issue with gmail or telus or both?

<comment><USER7> A little bit of both, really.

If Telus didn't have a misconfigured SPF record that caused host_check() to inadvertently (always?) return "pass", Gmail likely would have classified the messages as spam and the spammers probably would've quickly gave up.

On the other hand, one could reasonably argue that Gmail -- with all of their advanced algorithms and such -- _should have been_ able to easily determine that these messages were "forged" (the absence of a valid DKIM-Signature: should have been a giant red flag, for example) and reject them, ideally, at SMTP time or, at minimum, immediately dump them into a user's folder. Likewise, a more restrictive DMARC policy (i.e., "p=reject") than what Gmail currently has ("p=none") would also have caused these messages to be rejected (although DMARC can potentially introduce other issues or unintended side effects).

Alternatively, you could blame it on the spammers.

<comment><USER12> I think there's a pretty solid argument that Google shouldn't be trusting Telus's SPF records. Just to take it to the extreme, suppose a spammer were to send emails through a gateway that they control. In that case, there would be no third-party with independent SPF records to rely on since the spammer would control them.

Google shouldn't need any "advanced algorithms" to tell that the message didn't originate from their own mail servers, or an SMTP client. I'd expect this ability from any email provider. I'd be shocked if this was possible at, e.g. Fastmail.

</comment></comment></comment></comment><comment><USER13> Just wanted to say, the top response on the google forum is exactly why google needs real support and not community members copy-pasting "solutions".

<comment><USER14> Stories like this make me glad I use an email service which values me enough to have real humans who actually work there answer my support requests.

<comment><USER15> What do you use as your email service?

<comment><USER14> FastMail. I've opened a handful of support tickets and always gotten an answer within a few hours.

</comment></comment></comment></comment><comment><USER16> My house mate has had the same issue today on both of his Google accounts. He is both the sender and recipient and there were several other nonsensical email addresses being CC'd in.

SMTP headers show the emails are relayed from Telus. I'll provide the SMTP headers when I get home.

= = =

No unauthorised attempts to log in from third party sources, seperate passwords and MFA on both services.

It doesn't seem to me that the accounts have been compromised, instead the emails are spoofed. They have all been forwarded from Telus.com. The forum OP posted shows everyone else has the same issue.

Both accounts were sending hundreds of emails today and Google flagged the emails as likely having not been sent by him, but still did not place them in an appropriate spam filters and allowed them through to his inbox?

Edit:

= = = = =

I won't bother adding my headers now, the others that have even added theirs are almost identical to our own, here's a snippet of some one who posted below:

SPF and DMARC results

ARC-Authentication-Results: i=1; mx.google.com;

spf=pass (google.com: domain of firstname.lastname@example.com designates 220.127.116.11 as permitted sender) email@example.com; dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com

Authentication-Results: mx.google.com;

spf=pass (google.com: domain of email@example.com designates 220.127.116.11 as permitted sender) email@example.com;

dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com

Received: from gown.ShoppingBrew.com (ec2-13-58-85-245.us- east-2.compute.amazonaws.com. ) by mx.google.com with ESMTP id n59-v6si5794010qtd.116.2018.04.20.00.37.14 for <<email@example.com>>;

Received-SPF: softfail (google.com: domain of transitioning firstname.lastname@example.com does not designate 22.214.171.124 as permitted sender) client-ip=22.214.171.124;

<comment><USER17> What do the DKIM and SPF checks say?

<comment><USER16> Same as the others that have been posted.

DMARC failed and SPF shows that Telus.com was an approved SMTP relay for Google.com

Edit: posted into my original comment.

</comment></comment></comment><comment><USER18> This is spoofed email, with you also being the recipient as far as I can tell... Am I missing anything else in this matter? If not, this isn't new.

EDIT from below: "If I remember correctly, if you are the recipient of an email from "yourself" Google automatically puts it in the sent items label as well."

<comment><USER19> They are reporting the items in their sent items though...

<comment><USER20> My guess is the sent folder is just a label where from-address matches one of your emails. Spoofing the inbox in the manner mentioned here will naturally also fool the sent folder.

</comment></comment></comment><comment><USER21> Most people don't realize some services you "Logged into with Google" can also send emails in your name. I didn't come across anyone checking authorized apps in that thread. While this appears to be a spoofing issue, I suggest pruning the list of authorized apps frequently: [https://support.google.com/accounts/answer/3466521?hl=en](https://support.google.com/accounts/answer/3466521?hl=en)

<comment><USER22> Most people "don't realize" that because it's totally false. Only holders of specific OAuth scopes can use the Gmail API. The "basic account info" access that login with Google grants is not sufficient.

</comment></comment><comment><USER23> Relevant security issue Gmail declined to fix over a year ago: [https://www.zdnet.com/article/spammers-delight-gmail- weirdly...](https://www.zdnet.com/article/spammers-delight-gmail-weirdly- doesnt-see-spoofed-gmail-com-addresses-as-junk/)

<comment><USER24> I'm not sure how they would fix that, assuming that's even a bug. The email protocol is completely unverified, anyone can send the header they please, including spoofed From: headers. The GMail client itself even allows it, when you compose a new email you can change the "From" to anything. That's actually a rather useful feature when you have several addresses redirecting to one gmail address.

</comment></comment><comment><USER25> So it's not so simple. You could use DMARC to tell mail servers which honor DMARC to drop all e-mails that have @gmail.com addresses that don't come from gmail.com servers. In fact, this is how @google.com e-mail addresses are treated, and I believe this is a setting which G-Suite administrators can set up for their domains.

BUT. It comes with a downside. Suppose you want to send e-mail from your Linux laptop, or from a Linux mail server you control, without hard-coding your account password in a text file so you can send e-mail via a GMail server. Or suppose you want to subscribe to a mailing list which rewrites the subject line to include the mailing list name. DMARC breaks all of this. Horribly. So yes, it's more secure, but it comes with a massive cost.

What this means, for example, is I recommend people who work at Google, and who want to interact with either IETF mailing lists or the Linux-kernel mailing lists at vger.kernel.org to send their patches and PULL requests using their @gmail.com address. If they send it using their @google.com address, the same security settings that will prevent this spammers from "faking" e-mails that didn't come from gmail servers, will also break git send-email (unless you want to save your password into at text file --- which is against policy and common sense) and it will break traditional mailing lists.

</comment><comment><USER26> I got 2 of these a hour ago.

"This may be a spoofed message" Google says, I clicked spam even though it's from myself. It was to me and a bunch of other emails. Wasn't in my sent folder though and no one else has accessed my account.

"Sexy Girls Asian Girls Looking for US Men" is the subject and says it's sent from "\</comment><comment></comment><comment>----- via telus.com"

Really odd, seems to be some ISP in Canada and I live in the USA... Wonder how they got my email.

<comment><USER27> Telus is a phone/ISP company, they're pretty much uninvolved other then the ability to send emails from a @gmail.com address for their customers needs. Spammers are just utilizing that for malicious purposes with spoofed headers. As for how they got your email, the spammers could very well be working from the US too, Telus is just a tool. But then again on the internet boundaries matter less and they could be halfway across the world and got your email from a random online leaked list.

</comment></comment><comment><USER28> Another HN thread with more comments about this: [https://news.ycombinator.com/item?id=16894593](https://news.ycombinator.com/item?id=16894593)

</comment><comment><USER29> Probably unrelated, but telus.net's SPF record appears to authorize RFC6598 ([https://tools.ietf.org/html/rfc6598](https://tools.ietf.org/html/rfc6598)) IP space:

"v=spf1 ip4:188.8.131.52/24 ip4:18.104.22.168/24 ip4:22.214.171.124/24 ip4:184.108.40.206/26 ip4:188.8.131.52/24 ip4:184.108.40.206/24 mx ?all"

126.96.36.199/24 is within 22.214.171.124/10

Either I'm missing something, or Telus appears quite confused about the purpose/nature of SPF.

</comment><comment><USER30> I woke up this morning to several new labels in my gmail to delete all emails for "bank" "card" "paypal" etc, and paypal was hacked with purchases.

But my gmail has zero new logins, my 2fa wasn't triggered, etc.

How does a hacker create labels to delete my email but not register a login attempt or trigger my 2fa? I wish I was able to contact google.

EDIT: my only guess was accessing my PC where logins are saved, but I sleep in the same room and I don't think ninja spies broke in. Remote login? Seems farfetched.

<comment><USER31> the login occurred awhile ago?

</comment></comment><comment><USER32> The emails are spoofed. The bug is Google is labeling emails with "Sent Mail" because "from:" header matches your email.

I think the "bug" was that not all "Received-SPF" headers are not correctly checked (only first one was checked). However, I'm not even sure if this is a bug since I'm not sure if their migration of emails into G Suite will work if they start not trusting "from: header.

The real bug is probably that email is not marked as spam :)

</comment><comment><USER33> I had some of these earlier today as well. Mine wasn't from telus however, it was from some .science account. I use a password manager and have 2FA enabled, but I quickly switched my password just to make sure. Sure enough, a few hours later I got another one, for about 5 in total. They seemed to have stopped however.

</comment><comment><USER34> Something funny I've noticed is my business account is not receiving any spam but my free gmail account is.

</comment><comment><USER35> If you have a suspicious or spoofed email and you want people to analyze what happened, it helps a lot if you include the full headers. To do this in gmail, open the menu and pick "Show Original". Particularly useful are the lines that start with "Received:".

</comment><comment><USER36> This strategy seems odd. If they had simply omitted the spoofed sending email address from the To:/(B)cc lines, we'd never had seen them in our inboxes... right? Why call early attention to yourself?

I had 24 in my Inbox starting as 6:13PM (GMT-7).

<comment><USER37> Maybe that's part of the technique to trip up Google's spam filters, as Google might have assumed that spammers would never bcc the sender and thus treat such mails as more likely to be legitimate.

</comment></comment><comment><USER38> I have this problem with my Hotmail/Outlook account for almost 5 years and Microsoft team don't even understand what's going on. - [https://answers.microsoft.com/en- us/outlook_com/forum/oemail...](https://answers.microsoft.com/en- us/outlook_com/forum/oemail-osend/receiving-phishing-message-in-behalf-of-my- outlook/8201fe49-6a67-49a0-8f7e-b03f9a3bc786)

</comment><comment><USER39> Same thing here! I woke up this morning and saw that I've sent out spam emails (about 15 of them) with my email address via telus and receive responses in my inbox.

</comment><comment><USER40> To temporarily alleviate this issue, I created the following filter to stop my phone ringing constantly:

        from:(firstname.lastname@example.comfirstname.lastname@example.com) to:(email@example.com) -{has:attachment}

        Mark as read
        Skip the inbox

Until I added this rule I was being pinged once a minute since lunch time yesterday.

This ignores: emails from me, or some sales force spammer they were using, to me, that doesn't have an attachment (so I can still email myself files).

</comment><comment><USER41> I had the same issue tonight. It did not appear in my sent folder, however, and was sent from the same "firstname.lastname@example.com" account that everyone else reports. The most recent one (of 5 sent so far) was sent 2 minutes ago. I changed my password an hour ago - but as I suspected that didn't help because these aren't being sent via compromised accounts. Someone is using an SMTP server and just spoofing the sent from address.

</comment><comment><USER42> I had the same thing happen today. At least 6-8 emails in my inbox over the course of an hour or two, from my email address. Mostly ads for "dating" sites with photos of scantily-clad women. The to list includes my address, as well as about 8-10 other addresses, including one at rei.com and another at nih.gov.

Mine are showing Telus in the relay as well. None show up in the sent folder, and I use 2FA on the account.

</comment><comment><USER43> I wonder if telus did this to allow people using their email system to use Google calendar to send reminders.

<comment><USER44> Who is Telus? I'm seeing the spam sent from me via Telus, but I don't use Telus, afaik.

Their website is so abstract... sustainability, values, Health? No idea what they do.

<comment><USER43> Telus is one of the major Canadian telecom companies, and one of the largest ISP in Canada. As such they provide @telus.com email address, and my thinking is that this is why they would add google.com to their SPF record, so that people registering google accounts with their telus email address could receive reminders sent by google but with the user's email address in the from field.

</comment></comment></comment><comment><USER45> Some of you might want to see this as well:

[https://mashable.com/2018/04/22/google-gmail-spam- telus/](https://mashable.com/2018/04/22/google-gmail-spam-telus/)

</comment><comment><USER44> So who is Telus, and why are they special?

Is it Google who has a relationship with Telus -- because I'm pretty sure I don't.

Can Google prevent Telus from doing whatever they're doing? Or is Telus just the victim/conduit of the real spammers?

<comment><USER27> Telus is a phone company. They presumably deal with text/email stuff through their phone services, and they presumably have some sort of interactions with Gmail as a result. This isn't Telus doing it, it's just spammers utilizing the ability for Telus to send emails to customers. From someone else in the thread: "it looks like telus.com has set up SPF records allowing people to send mail as @gmail.com via Telus' servers. That's fine. These messages are being sent with a "email@example.com" return address (the "envelope from")". Telus is just being maliciously used for something it rightfully offers to customers.

</comment></comment><comment><USER46> A bit unrelated but requiring login to just read a forum thread is not good. :( I don't want to login to google again on this device therefore I haven't seen the thread.

</comment><comment><USER47> Wow. I've been facing this since yesterday night, didn't know the entire internet is facing this problem. There's still no official response from Google it seems.

</comment><comment><USER44> If the emails are (spoofed as) from me, and I tell gmail to mark them as spam, does anything bad happen?

Gmail shows a weird "Mute" instead option -- never saw that before.

</comment><comment><USER48> I've had similar problem a long time ago with my yahoo account. (Password change didn't help) So, I cleared my yahoo contact list and that stopped the spam.

</comment><comment><USER49> I've been debating leaving Google Apps for months now and oddly enough this is the straw that broke the camels back. Will be migrating to a new host today.

</comment><comment><USER50> This happened to me today as well. I also run 2FA. Did not see any suspicious devices or activity in the log, other than the sent emails.

</comment><comment><USER51> Crazy. This was happening to me today as well. Tonnes of spam from my email, but being sent to these weird blanket emails. Worrying.

</comment><comment><USER52> I had the same thing in my account (same relay through Telus). Here're my headers

      Delivered-To: <firstname.lastname@example.com>
      Received: by 10.74.77.209 with SMTP id p78csp1252253ood;
              Sat, 21 Apr 2018 19:48:30 -0700 (PDT)
      X-Google-Smtp-Source: AB8JxZrx9G5VDRbvtvoQWl5sUYm3w7k1TQ5f+Sd3g74T+fFLkrWnEV7qhVmFTr7X0pBQCd5q+my5
      X-Received: by 2002:a6b:6f01:: with SMTP id k1-v6mr16819882ioc.221.1524365310928;
              Sat, 21 Apr 2018 19:48:30 -0700 (PDT)
      ARC-Seal: i=1; a=rsa-sha256; t=1524365310; cv=none;
              d=google.com; s=arc-20160816;
              b=Ry11M99U7ldzJoPvejp48dePTM/MlHI4xQTc2jrwZR3CeugDTEfUpA783hpLnaw0gg
               NCsTVBtObV1GYioVRQDSxWAczHFiPQGld0u5afD+xpb2eGpr7/eZxTwvJPHYpl/FLwNk
               pNXj3w7VObPIyj43K4Zkf9rgNF1TRCYx4RbRvesaBcHMADJS1vDRB5TAsJ8DV6dF7gOB
               +O59qvWZzg0nE265rBJ1b8fWXWuQb4KpdVdwolZ3T3fqFDGY2cHnsmZMWTRzcjsLFWuD
               86+fIW1ccWf1eIjNh3LvecY6B0zzW9LjfgQw+0IvrkEdbwDc1EAbNhWI6kilOPIsDJGD
               Lzng==
      ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816;
              h=date:message-id:subject:to:from:arc-authentication-results;
              bh=4oe6QhhObsHLHbjLfsZs16iUEYy2rMdtn0ju3umolqQ=;
              b=FoRwZqhc5F7H6pItUYqZ2y/OxsZQkWNDEhj4Ody6uJ1vaC3DzUbXqa4mw1Pb0AgfZe
               QaBcfWaloNJJXBBWIjERShMCo3wYb/wcXtdOlT4x3o7uhAxQJ5sGBQqnVQ4QfH/d9pIh
               DaqTXWcaEieX3tsVDXO8UtZviUTsA7FjO2YGkk/f4rj1K9VOkxqiyECGyQf1uDAI/55d
               7O1t76oCpYr/qyAAx2YGBnz87ShD4bORPOg8iHwb9f4zAq7tfwOoF/Z3blPFR8EA2Xam
               q9x+2OIRsA2oX+t/HNsdrYOkWPkYwhiHwptl0vQZDHZn3E4Uue8DofG5sRLoAFM1rVYJ
               e5RA==
      ARC-Authentication-Results: i=1; mx.google.com;
             spf=pass (google.com: domain of firstname.lastname@example.com designates 22.214.171.124 as permitted sender) firstname.lastname@example.com;
             dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com
      Return-Path: <email@example.com>
      Received: from shop.eseonew.com (static-ip-69-64-35-11.inaddr.ip-pool.com. [184.108.40.206])
              by mx.google.com with ESMTP id v64-v6si7872516iof.146.2018.04.21.19.48.30
              for <<email@example.com>>;
              Sat, 21 Apr 2018 19:48:30 -0700 (PDT)
      Received-SPF: pass (google.com: domain of email@example.com designates 126.96.36.199 as permitted sender) client-ip=126.96.36.199;
      Authentication-Results: mx.google.com;
             spf=pass (google.com: domain of firstname.lastname@example.com designates 184.108.40.206 as permitted sender) email@example.com;
             dmarc=fail (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com
      Received: from gown.ShoppingBrew.com (ec2-13-58-85-245.us-east-2.compute.amazonaws.com. )
              by mx.google.com with ESMTP id n59-v6si5794010qtd.116.2018.04.20.00.37.14
              for <<firstname.lastname@example.com>>;
              Fri, 20 Apr 2018 00:37:14 -0700 (PDT)
      Received-SPF: softfail (google.com: domain of transitioning firstname.lastname@example.com does not designate 184.108.40.206 as permitted sender) client-ip=188.8.131.52;
      from: ABC Shark Tank <<email@example.com>>
      To: <firstname.lastname@example.com>, <firstname.lastname@example.com>, <email@example.com>, <firstname.lastname@example.com>, <firstname.lastname@example.com>, <email@example.com>, <firstname.lastname@example.com>, <email@example.com>, <firstname.lastname@example.com>
      Subject: Exclusive Limited Time Online Offer Shark Tank Success Story
      Message-ID: <email@example.com=Mx.google.com>
      Content-Type: multipart/report; boundary="f4f5e80f07d80f991b056a2936a0"; report-type=delivery-status
      X-EMMAIL: <@googlemail.fr <email@example.com>>
      Date: Sat, 21 Apr 2018 22:48:30 -0400

      --f4f5e80f07d80f991b056a2936a0

<comment> ryan-c Some parts of these headers look faked to me, in particular, the bottom most Received is definitely faked, and probably also the bottom most Received-SPF and Authentication-Results.

The current SPF records for telus.com don't seem to allow sending by 22.214.171.124.

Did someone figure out how to trick gmail into accepting bogus headers indicating the SPF passed?

Also, the timestamps on the received headers differ by a lot. This one:

        Received: from gown.ShoppingBrew.com (ec2-13-58-85-245.us-east-2.compute.amazonaws.com. )
                by mx.google.com with ESMTP id n59-v6si5794010qtd.116.2018.04.20.00.37.14
                for <email@example.com>;
                Fri, 20 Apr 2018 00:37:14 -0700 (PDT)

appears to be identical (except for the email address) for the two sample sets of headers in the thread.

<comment> ryan-c Telus has this entry:

        exists:CL.%{i}.FR.%{l}.F2.%{o}.spf.nssi.telus.com

Reading RFC 7208, that would be expanded to

        exists:CL.18.104.22.168.FR.reply.F2.telus.com.spf.nssi.telus.com

which means if that any record exists at that name, it will pass.

        dig +short cl.188.8.131.52.fr.reply.f2.telus.com.spf.nssi.telus.com
        127.0.0.1

trying a few other values, it seems that telus.com is saying _ALL_ IP addresses are allowed to send for it.

<comment><USER53> It seems like everything in the zone "spf.nssi.telus.com" resolves, regardless of further DNS labels. So yeah, I'd say every host with any IP is allowed to send mails as anything from telus.com. That's a bit unsettling.

<comment> ryan-c They appear to have quitely fixed it.

<comment><USER53> Indeed, the DNS records are gone. They had a tweet[1] 1 hour or 2 ago how they are working on it. I guess someone got phoned on his sunday to fix it. I'm hoping for a further update from their side what happened.

1: [https://twitter.com/TELUSsupport/status/988060048843657216](https://twitter.com/TELUSsupport/status/988060048843657216)

</comment></comment></comment></comment></comment></comment><comment><USER54> This is pretty alarming. Is there another service to switch to that's as reliable and more generally safe as Gmail?

</comment><comment><USER55> Great to see this! I was getting mad at all this SPAM coming from myself today!

</comment><comment><USER56> Perhaps it's a browser extension/plugin that got hacked?

<comment><USER57> Yeah, I am also thinking app or phone

</comment></comment><comment><USER58> My father and I have been getting these all evening.

</comment><comment><USER59> Ditto here. 1Password generated pw, 2fa, etc.

</comment><comment><USER60> Yes my gmail spam has gone nuts!!!! Wtf has happened

</comment><comment><USER61> From the way the emails are sent, I bet it's an Android security hole.

<comment><USER62> What about those of us who don't use Android phones?

</comment></comment><comment><USER63> I remember when my mom's machine started sending spam with my name in the address field. Clever Trojan.

</comment><comment><USER64> There was an attack going around many years ago that was basically a spam email that had code embedded in it, which would hack your browser, causing you to send out more spam email when you logged into your account. I assume this is the same sort of thing.

<comment><USER18> Nope. This is just Gmail appending the "Sent" label to an email that you received from "you". You didn't actually send it, it was just a spoofed From header.

</comment></comment><comment><USER65> Hey guys, you can contact tellus via this link. You don't need to he a customer for this.

[https://www.telus.com/en/support/article/ccts-and-cprst- feed...](https://www.telus.com/en/support/article/ccts-and-cprst-feedback-and- contact-information)</comment>